Defence Cyber Certification, without the complexity.

Get your business ready for DCC. From Cyber Essentials and technical remediation to policies, evidence and assessment preparation, we help you get ready for independent certification. UK-based support, Cyber Essentials expertise, practical implementation and ongoing cyber security.

Book a DCC readiness call · Understand your DCC requirements

What is Defence Cyber Certification?

Defence Cyber Certification is the assurance scheme supporting the Ministry of Defence’s Cyber Security Model. It demonstrates that organisations handling defence work have appropriate cyber security and resilience in place, measured against DEF STAN 05-138 Issue 4.

There are four levels, and the one you need is set by the Cyber Risk Profile attached to the work.

What is DEF STAN 05-138?

DEF STAN 05-138 Issue 4 is the Ministry of Defence’s cyber security standard for the defence supply chain. It sets out the controls behind Defence Cyber Certification: 3 at Level 0, 101 at Level 1, 139 at Level 2 and 144 at Level 3. If a tender, contract or prime-contractor requirement quotes “DEF STAN 05-138” rather than “DCC”, it is asking for the same thing under its formal name.

Each level sets a different bar, summarised in the cards above. Level 0 is the baseline every MOD supplier is expected to reach. Level 1 adds a full, organisation-wide control set for low to moderate risk work. Levels 2 and 3 are reserved for high and substantial risk programmes and require Cyber Essentials Plus on top. The controls scale from 3 at Level 0 to 144 at Level 3, but Cyber Essentials sits underneath every one of them.

Level 1 is where most SME suppliers first feel the difference. Its 101 controls cover:

• Security governance
• Policies and procedures
• Risk management
• Asset management
• User and access controls
• Endpoint security
• Patch management
• Encryption
• Email and network security
• Staff awareness
• Supplier security
• Vulnerability management
• Logging and monitoring
• Incident response
• Business continuity and recovery

Nerdster can help you build and evidence the complete programme, and for Level 2 and Level 3 we work with your internal team and specialist certification partners to identify gaps, implement controls and prepare the organisation for assessment.

Not sure which level you need?

You do not need to decode the Defence Standard yourself.

If an MOD customer, prime contractor or procurement process has given you a Cyber Risk Profile, we review the requirement and explain what it means for your business. If you are preparing ahead of a defence opportunity, we assess your current environment against the appropriate DCC requirements.

Talk to a DCC specialist

From requirement to ready

1. Understand

We review your DCC requirement, Cyber Risk Profile and current cyber security environment. You get a clear explanation of what applies to your organisation.

2. Assess

We compare your existing security against the required controls. Already have Cyber Essentials, ISO 27001, Microsoft 365, Intune or other controls in place? We identify what can be reused and where the real gaps are.

3. Fix

We help implement what is missing. That can include policies and procedures, Microsoft 365 security, Intune and endpoint management, MFA and identity security, access controls, device configuration, patch management, EDR and malware protection, firewalls and network security, encryption, backups and recovery, logging and monitoring, vulnerability management, supplier controls, staff cyber awareness and incident response.

4. Evidence

Having security controls is not enough if you cannot demonstrate them. We build an organised evidence pack showing how each control is implemented and managed.

5. Prepare

Before independent assessment, we work through outstanding issues and help your team prepare for the certification process.

6. Maintain

Cyber compliance is not a once-a-year scramble. Nerdster can continue managing your IT, cyber security, monitoring, policies and evidence so your environment stays ready.

Already have Cyber Essentials?

Good. You already hold part of the foundation, and at Level 0 most of it. Above that, DCC asks about how the whole business runs its security: who owns risk, how suppliers are vetted, what happens when something goes wrong. Nerdster helps bridge that gap.

1. Cyber Essentials. basic technical cyber hygiene. See our Cyber Essentials packages.
2. DCC readiness. technology, people, processes, policies, evidence and resilience.
3. Independent DCC assessment. Assessment and certification through an approved DCC Certification Body licensed by IASME.

What you get

• DCC gap assessment. a structured review against the controls applicable to your required DCC level.
• Readiness score. where you are today, what is already covered and what still needs attention.
• Remediation plan. a prioritised action plan instead of a 100-page compliance document nobody understands.
• Technical implementation. where required, Nerdster implements and manages the underlying security technology.
• Policies and procedures. the governance and operating procedures the controls call for.
• Evidence pack. evidence organised against the relevant controls, ready for assessment preparation.
• Certification support. we work alongside your chosen independent DCC Certification Body through the certification process.
• Ongoing management. your security controls kept maintained after certification.

Already using Microsoft 365?

You may be closer than you think. For many SMEs, capabilities already available within Microsoft 365, Entra and Intune contribute to identity, MFA, device management, access control, security configuration, endpoint protection, logging and data protection.

The challenge is configuring them correctly, documenting them and filling the gaps around them. That is where Nerdster comes in — see our Microsoft 365 support.

Built for SMEs in the defence supply chain

You should not need a full-time compliance department just to understand what your MOD customer is asking for. Nerdster combines IT, cyber security and practical compliance implementation into one service, and focuses on getting the controls working in the real business, not on producing policies for a folder.

• We implement the changes ourselves rather than handing you a list of what is wrong.
• You always know what is complete, what is missing and what happens next.
• If you want, we keep running the underlying security controls after the project finishes.
• Support comes from a UK technology and cyber security team.

DCC readiness packages

DCC Level 0 readiness

For organisations requiring the foundation level of Defence Cyber Certification. Includes a Cyber Essentials review, technical gap assessment, remediation support, DCC readiness review, evidence preparation and certification coordination.

Get Level 0 ready

DCC Level 1 readiness

For organisations that need to demonstrate a comprehensive cyber security programme against the Level 1 controls. Includes a full control gap assessment, technology review, policy and governance review, risk and asset management, security remediation, evidence mapping, staff and supplier requirements, incident and recovery preparation, a pre-assessment review and certification coordination.

Get Level 1 ready

Level 2 and Level 3

Higher DCC levels require considerably more advanced cyber security capability and Cyber Essentials Plus. Talk to us about your requirement and we will help establish the right programme.

Discuss Level 2 or Level 3

Do not wait for a defence opportunity to expose the gaps

Whether you have already been given a DCC requirement or simply want to become ready to supply the defence sector, we will show you where you stand and what needs to happen next. Start with a DCC readiness review: understand your current position, identify the gaps and build a clear route to certification.

Book your DCC readiness call